CVE-2023-0582: Path Traversal in ForgeRock Access Managment

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-27 · updated 2026-06-17
Weakness: CWE-22

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ForgeRock Access Management allows Authorization Bypass. This issue affects access management: before 7.3.0, before 7.2.1, before 7.1.4, through 7.0.2.

Affected products

ForgeRock Access Management: before 7.1.4; 7.2.0 — fixed in 7.1.4

How to fix

Upgrade to a fixed version: ForgeRock Access Management 7.1.4. Check the vendor advisory for mitigations.

References

https://backstage.forgerock.com/downloads/browse/am/featured
https://backstage.forgerock.com/knowledge/kb/article/a64088600
https://backstage.forgerock.com/downloads/browse/am/featured
https://backstage.forgerock.com/knowledge/kb/article/a64088600

Get alerted when CVE-2023-0582 or the next vulnerability affects your stack